New Bagle, Netsky Worms on the Loose

A pair of new mass-mailing worms hit corporate networks Wednesday. While bothersome to IT managers, security experts rated the threats as mid-level risks.

Two new mass-mailing worms hit corporate networks Wednesday, continuing what has been a miserable spring for IT managers who have had to deal with an unrelenting rash of malware.
The two newest entrants are Bagle.AA and Netsky.AB, both of which have been rated as medium risks by antivirus vendors. There is little new in either of the viruses and they both borrow heavily from their forebears.
The new variant of Bagle uses an increasingly popular tactic among virus writers: attempting to terminate various security applications, including antivirus software and personal firewalls. The rest of its behavior is fairly typical, as the virus arrives via e-mail with a random subject line and spoofed sending address. Subject lines include "Re: Msg reply," "Re: Yahoo," and Re: Document." The text of the e-mail is random and meaningless, as well.

The actual virus-infected attachment has any one of a number of file extensions, including .vbs, .hta, .exe and .scr. Once executed, the virus harvests e-mail addresses from the infected machine and begins mailing itself out. Bagle.AA also opens TCP Port 2535 and tries to send a message to the virus author notifying him that the machine is infected.